Wordpress has a bad rep on security. It is possible that wp was the attack vector.

664 means that:

• you have read and write access
  
• your group has read and write access
  
• the world has read access

It will be more secure if it is 644 - then your group does not have write access.

Here is hostgator's article on permissions: http://support.hostgator.com/articles/cpanel/how-to-change-permissions-chmod-of-a-file

Very sorry for the confusion. The permission code was, in fact, 644. I misread it.

Thanks,

doug